Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
203 results · page 2 of 5
Jul 3, 2023Cross Site Scripting vulnerability in mlogclub bbs-go v.CVE-2023-36222 · Other software · Bbs-go · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.
- Product
- Bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.CVE-2023-27755 · Other software · 71note · reported by MITREHigh 8.8
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
- Product
- Go-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.CVE-2023-27089 · Other software · Ehuacui-bbs Project · reported by MITREHigh 8.2
Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.
- Product
- Ehuacui-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.14k is vulnerable to CVE-2023-26692 · Other software · Zcbs · reported by MITREMedium 6.1
ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.14k is vulnerable to Cross Site Scripting (XSS).
- Product
- Zbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 6, 2023A vulnerability was found in ehuacui bbs.CVE-2023-1200 · Other software · ehuacui · reported by VulDBLow 3.5
A vulnerability was found in ehuacui bbs. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-222388.
- Product
- bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022A vulnerability was found in xiandafu beetl-bbs.CVE-2022-4347 · Other software · xiandafu · reported by VulDBLow 3.5
A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215107.
- Product
- beetl-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.CVE-2020-19914 · Other software · Xiuno · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkevinoclam.github.iokevinoclam.github.io
Jun 2, 2022bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.CVE-2021-38221 · Other software · Bbs-go Project · reported by MITREMedium 5.4
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
- Product
- Bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.CVE-2022-30050 · Other software · SIR · reported by MITREMedium 6.1
Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgratis-herring-da5.notion.sitegratis-herring-da5.notion.site
Mar 31, 2022Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.CVE-2022-27496 · Other software · Zero-Channel BBS Plus Developers · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- Zero-channel BBS Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.CVE-2021-43103 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.CVE-2021-43102 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitraryCVE-2021-43101 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.CVE-2021-43100 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladedCVE-2021-43099 · Other software · Diyhi · reported by MITREMedium 4.9
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.CVE-2021-43098 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code.CVE-2021-43097 · Other software · Diyhi · reported by MITREHigh 7.2
A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the SearcCVE-2022-23391 · Other software · Pybbs Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Search box.
- Product
- Pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.CVE-2022-23390 · Other software · Diyhi · reported by MITRECritical 9.8
An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.
- Product
- BBS Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.CVE-2022-24677 · Other software · Hyphp · reported by MITRECritical 9.8
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.
- Product
- Hybbs2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.CVE-2022-24676 · Other software · Hyphp · reported by MITREHigh 8.8
update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
- Product
- Hybbs2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2.CVE-2021-46030 · Other software · Javaquarkbbs Project · reported by MITREMedium 5.4
There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
- Product
- Javaquarkbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via CVE-2020-23719 · Other software · Zibbs Project · reported by MITRECritical 9.6
Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.
- Product
- Zibbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.CVE-2020-23718 · Other software · Zibbs Project · reported by MITRECritical 9.6
Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.
- Product
- Zibbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2021A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.CVE-2020-28702 · Other software · Pybbs Project · reported by MITREHigh 7.5
A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.
- Product
- Pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uCVE-2021-36512 · Other software · Synchro · reported by MITREHigh 7.5
An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value.
- Product
- Bulletin Board System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.synchro.netgitlab.synchro.net
Oct 4, 2021A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTMCVE-2020-21496 · Other software · Xiuno · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitebrief parameter.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTMCVE-2020-21495 · Other software · Xiuno · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitename parameter.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML viaCVE-2020-21494 · Other software · Xiuno · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.CVE-2020-21493 · Other software · Xiuno · reported by MITREMedium 5.3
An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.CVE-2020-18663 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.CVE-2020-18661 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2020Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code.CVE-2020-25006 · Other software · Heybbs Project · reported by MITRECritical 9.8
Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code.
- Product
- Heybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comjazzsec.com
Sep 3, 2020Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.CVE-2020-25005 · Other software · Heybbs Project · reported by MITRECritical 9.8
Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.
- Product
- Heybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comjazzsec.com
Sep 3, 2020Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.CVE-2020-25004 · Other software · Heybbs Project · reported by MITRECritical 9.8
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.
- Product
- Heybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comjazzsec.com
Apr 29, 2020ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.CVE-2019-5621 · Other software · ABBS Software · reported by cve@rapid7.comHigh 7.8
ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
- Product
- Audio Media Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2020Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.CVE-2017-6371 · Other software · Synchro · reported by MITREHigh 7.5
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 8, 2020nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).CVE-2019-20367 · Other software · Siemens · reported by MITRECritical 9.1
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggitlab.freedesktop.org
Dec 25, 2019Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.CVE-2019-19998 · Other software · Xiuno · reported by MITREHigh 7.5
Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 20196kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).CVE-2015-9292 · Other software · 6kbbs · reported by MITREHigh 8.8
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
- Product
- 6kbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Mar 29, 2019An issue was discovered in HYBBS 2.2.CVE-2019-10644 · Other software · Hyphp · reported by MITREHigh 8.8
An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account.
- Product
- Hybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019An issue was found in HYBBS through 2016-03-08.CVE-2018-14499 · Other software · Hyphp · reported by MITREMedium 6.1
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html.
- Product
- Hybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2018_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a craftedCVE-2018-16790 · Other software · Mongodb · reported by MITREHigh 8.1
_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.
- Product
- Libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Aug 19, 2018The editor in Xiuno BBS 4.0.4 allows stored XSS.CVE-2018-15559 · Other software · Xiuno · reported by MITREMedium 6.1
The editor in Xiuno BBS 4.0.4 allows stored XSS.
- Product
- Xiunobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbs.xiuno.combbs.xiuno.com
Jun 23, 2018mao10cms 6 allows XSS via the m=bbs&a=index page.CVE-2018-12695 · Other software · Mao10 · reported by MITREMedium 6.1
mao10cms 6 allows XSS via the m=bbs&a=index page.
- Product
- Mao10cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2018Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.CVE-2018-8942 · Other software · Xiuno BBS Project · reported by MITREMedium 5.4
Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.
- Product
- Xiuno BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2018Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-0535 · Other software · Kagaminokuni · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- Product
- PHP 2chBBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2017In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to CVE-2017-14227 · Other software · Mongodb · reported by MITREHigh 7.5
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
- Product
- Mongodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.redhat.com
Jan 13, 2017Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-baCVE-2016-2090 · Other software · Fedoraproject · reported by MITRECritical 9.8
Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.
- Product
- Fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comblog.fuzzing-project.org
Dec 27, 2015Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectorsCVE-2015-7783 · Other software · Let's Php! · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Pbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.